skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auth-oauth

Validates OAuth 2.0 and OpenID Connect security posture for web and mobile apps.

Updated Jul 30, 2026
Search Tags:#authentication#oauth#oidc#security-audit#pentest#pkce
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill auth-oauth-salmanabdurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-oauth
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/auth-oauth
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill auth-oauth-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complexity of securing OAuth 2.0 and OpenID Connect implementations by providing a structured, policy-gated framework to identify common vulnerabilities like redirect URI bypasses, CSRF-based account linking, and improper token handling.

Core Features & Use Cases

  • Flow Security Review: Systematically validates redirect_uri enforcement, state/nonce handling, and PKCE requirements.
  • Posture Assessment: Evaluates token lifecycle, audience binding, and scope hygiene to prevent unauthorized access.
  • Use Case: Use this skill during a security assessment to verify that a client application correctly enforces PKCE and validates redirect URIs, preventing potential authorization code theft.

Quick Start

Use the auth-oauth skill to perform a security posture review on the target OAuth client using the provided discovery document and test-owned account credentials.

Frequently Asked Questions about auth-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit OAuth 2.0 redirect URI enforcement and state management?▼

To audit OAuth 2.0 redirect URI enforcement and state management, you validate URI bypasses, CSRF-based account linking, and state parameter handling using a structured, policy-gated framework to verify secure authorization flows.

What is PKCE compliance testing in OpenID Connect security assessments?▼

PKCE compliance testing verifies that client applications correctly enforce Proof Key for Code Exchange requirements, preventing potential authorization code theft during mobile and web application security assessments.

Can I use this skill to test token lifecycle integrity for mobile applications?▼

Yes, you can assess token lifecycle integrity for mobile applications by evaluating audience binding, scope hygiene, and token handling to prevent unauthorized access, provided you use test-owned accounts and registered clients.

How do I perform a security posture review on an OAuth client using a discovery document?▼

To perform a security posture review on an OAuth client, input the provided discovery document and test-owned account credentials to systematically validate authorization gates, scope validation, and PKCE compliance.

What are the limitations of pentesting OAuth 2.0 flows without authorized access?▼

Pentesting OAuth 2.0 flows without authorized access is limited because safe testing requires strict adherence to defined authorization gates, scope validation, evidence recording protocols, and the use of test-owned accounts and registered clients.

Related Skills

Explore More Software Engineering Skills→
RedHatProductSecurityRedHatProductSecurity
47

mcp-client-dynamic-client-registration

Automate OAuth 2.0 MCP client registration with RFC 7591 authorization servers.

Official
Intermediate
sjinkssjinks

security-review-owasp-oauth2

Review OAuth 2 implementations for security weaknesses against OWASP guidance.

Community
Advanced
DorianGalloDorianGallo
5

oauth-oidc-misconfiguration

Identify OAuth 2.0 and OpenID Connect misconfigurations in login flows.

Community
Intermediate
SnailSploitSnailSploit
2.9k

oauth-attacks

Test OAuth 2.0 and OIDC implementations for redirect_uri bypass and token leakage.

Community
Advanced